Operation Ghost-Campus: AI Agents Steal API Keys and Student Data in Shanghai College Breach

A newly disclosed threat-intelligence investigation, VECERT-TI-2026-1107-B, describes an alleged automated campaign combining mass FOFA account creation, harvesting of exposed OpenAI and DeepSeek API keys, academic-fraud automation, and collection of student personal data.

VECERT calls the activity Operation Ghost-Campus and links it to infrastructure associated with the Shanghai Publishing and Printing College’s Fengxian campus. The findings remain intelligence assessments, not formal legal attribution.

At the center of the reported operation is an AI-oriented resource-acquisition agent. Rather than manually searching for exposed credentials, the operator allegedly automated the workflow: registering FOFA accounts, receiving confirmation emails, activating accounts, querying internet-facing assets, extracting secrets, and validating stolen API keys.

Operation Ghost-Campus

To evade free-tier restrictions on FOFA, the actor reportedly built a private catch-all email system under the domain melocc.cc. Its mail, API, POP, IMAP, and SMTP subdomains resolve to the same server, allowing scripts to create accounts and retrieve activation messages without disposable-email providers.

VECERT says it recovered fofa_accounts.csv and control-panel evidence indicating at least 1,438 unique FOFA accounts, with passwords and JWT tokens.

By rotating tokens across the account pool, the operator could distribute search activity and potentially conduct tens of thousands of queries daily at little or no cost.

The searches reportedly target exposed .env files, Docker configurations, and poorly secured Git repositories, where developers may accidentally leave cloud credentials, database strings, and AI-provider keys.

Once a vulnerable host is found, the system allegedly uses regular expressions to extract API keys. OpenAI project keys beginning with sk-proj- are checked against OpenAI’s API, with results sorted into valid, exhausted, or revoked categories. DeepSeek keys matching a 32-character hexadecimal pattern are reportedly tested for functionality and remaining balance.

Valid keys become a source of free inference capacity: the attacker can route coding assistance, data processing, and automated workflows through accounts paid for by other organizations. VECERT states that stolen credentials powered a GoTTY-based web terminal branded Pi — AI Coding Assistant, supporting the broader operation.

This reflects an emerging abuse pattern: exposed secrets can sustain an autonomous agent that continuously finds, validates, and consumes additional credentials.

The investigation also alleges that the same infrastructure supported automation targeting the Shanghai Publishing and Printing College. Scripts described as heartbeat bots sent HTTP requests every 30 seconds to imitate an active student reading session on mandatory digital-learning platforms.

After sufficient simulated activity, the scripts allegedly called internal APIs to claim bonus points, while monitoring whether accounts had been frozen.

Such automation could distort attendance, participation, or supplementary-credit systems that rely on interaction time rather than verified learning. The reported balance of 252 points suggests sustained, repeatable manipulation rather than a one-time exploit.

More serious is the alleged exposure of records for 5,132 students at the Fengxian campus. VECERT says the data included names, student identification numbers, mobile numbers, 18-digit national ID numbers, home addresses, campus-card balances, and transaction histories for cafeterias, laundry, water, and electricity. The records reportedly refreshed every 48 hours.

The alleged QR-code module is particularly concerning. If an attacker can maintain active sessions and generate valid payment codes for campus cards, high-balance accounts could be exploited for fraudulent purchases within university facilities. The report cites balances reaching 1,474.84 yuan, illustrating financial exposure beyond privacy harm.

Mitigation

The case shows that AI systems expand the consequences of ordinary configuration failures. Organizations should prevent secrets from entering public repositories, web directories, container images, or .env files; rotate exposed credentials; enforce spending limits and usage alerts; and monitor API calls from unfamiliar networks.

Educational institutions should treat student identity data, campus-card balances, and transaction histories as high-risk assets. Strong session controls, network segmentation, anomaly detection, and rapid revocation of compromised tokens are essential.

The Shanghai Publishing and Printing College is a real institution founded in 1953, but the breach allegations and actor attribution require independent verification by the institution and relevant authorities.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.